The State-Criminal Convergence: When Governments and Hackers Share Servers

This series began as an attempt to map impunity: to explain why the abusive infrastructure visible from a honeypot, an abuse queue, a BGP table, a corporate registry, or a sanctions filing persists despite being both obvious and harmful. A simpler story was available. One could say regulators are behind, that corporations are negligent, that criminals move faster than law. Those things are true in fragments. They are not the core truth. The core truth is darker: the architecture remains unreformed because powerful states use the same architecture, need the same ambiguities, and benefit from the same failures that protect criminals.

We did not start with that conclusion. We arrived there because every layer kept collapsing toward the same shape. Bulletproof hosts sat in ordinary transit. VPN providers served everybody at once. Military telecoms carried criminal scanning and proxy fleets. Spyware vendors emerged from military talent pipelines and operated through the same offshore legal shells as private operators. State intelligence and criminal abuse did not merely resemble each other. They cohabited the same pipes.

That is the final argument of The Architecture of Impunity: the system persists not because it has failed, but because it serves multiple elites at once. The criminal wants money. The provider wants revenue. The state wants deniable reach. Reform would harm all three. So reform remains partial, theatrical, or selectively applied.

1. The thesis: the architecture exists because states need it too

If a state genuinely wanted a globally clean, strictly attributable, tightly regulated internet infrastructure stack, it could push much harder than it does. States regulate banks, aviation, weapons exports, customs, telecom licensing, satellite slots, and submarine cables with immense force when their core interests are engaged. They know how to compel compliance. They know how to create real due-diligence burdens. They know how to criminalize facilitation. They know how to impose operational reporting requirements and punish noncompliance. The reason the internet’s abuse architecture remains so permissive is not lack of capacity. It is conflicted interest.

Intelligence services need routing ambiguity. Law-enforcement agencies need cooperative intermediaries but also covert avenues. Militaries need rapid-access commercial infrastructure. States conducting surveillance, disruption, access operations, and geopolitical cyber maneuvering do not want a world in which every server is strongly attributable, every reseller chain is transparent, every VPN user is deanonymized, and every abuse-tolerant provider is structurally impossible to operate. They want selective visibility for themselves and persistent opacity for everyone else.

This does not require a global conspiracy meeting in a dark room. It requires something simpler and more durable: convergent incentives. Criminals, spy services, proxy vendors, surveillance firms, and permissive providers all want the same core properties from infrastructure — reachability, deniability, jurisdictional arbitrage, resale layers, and friction against scrutiny. When different actors need the same properties, the market reliably builds them.

2. Case 1 — Russia / Stark: Sandworm shares commercial substrate with fraud and DDoS crews

The Stark case is one of the cleanest demonstrations that “state infrastructure” and “criminal infrastructure” are often just labels imposed after the fact on the same commercial environment. Stark Industries was incorporated on 10 February 2022, fourteen days before Russia’s full-scale invasion of Ukraine. It became relevant because offensive Russian-aligned activity, including Sandworm associations and NoName057(16) DDoS operations, intersected with infrastructure in the same broad environment that also served ordinary cybercrime, spam, fraud, and proxy-style abuse.

The significance of Stark is not that every packet through the ASN belongs to the GRU. That would be sloppy. The significance is that actors with radically different public meanings — a military intelligence unit tied to destructive operations and criminal crews tied to opportunistic monetization — can inhabit commercially adjacent, functionally interchangeable hosting space. The architecture does not distinguish moral category. It allocates IP space and forwards traffic.

The phrase “No one contacted us” deserves attention because it is more than customer support theater. It is an operating doctrine. It allows providers to convert passivity into innocence. For criminals, it means time. For states, it means diplomatic insulation. A provider never has to say “we support the mission.” It only has to say “we did not know,” “we were not informed,” or “the abuse was not properly escalated.” The result is the same: infrastructure remains live while investigators burn time proving what everyone can already see in telemetry.

Once you accept that a military unit and a credit-card fraud crew can procure from functionally similar commercial environments, the conceptual wall between state and criminal operations begins to crack. Not because they are identical in mission, but because they are identical in infrastructure appetite.

3. Case 2 — Israel / Unit 8200: military SIGINT exported through private companies

If the Stark case shows state and criminal actors sharing commercial space, the Unit 8200 pipeline shows something even more direct: state capability moving into private corporate form without losing its institutional DNA. Unit 8200, Israel’s military SIGINT and cyber-intelligence apparatus, has seeded an entire private surveillance economy. NSO Group, Candiru, Paragon, Cellebrite-adjacent ecosystems, and a broader web of founders, investors, export controls, and government customers demonstrate that the boundary between state function and private profit is not a line. It is a hiring pipeline.

NSO is the clearest example. Its founders came from Unit 8200. Its products required Israeli Ministry of Defence export licensing. Its customers were governments. Its capabilities served diplomatic and intelligence priorities. It was described in major reporting as a de facto arm of state power. Yet it operated as a private company, raised money like a private company, litigated like a private company, and hid behind the language of lawful intercept and legitimate government customers when challenged.

Candiru reinforces the same pattern. Shared investors, overlapping government clientele, Entity List exposure, and the same recruitment pool make the ecosystem legible as a capability market formed around state-trained personnel. The important point is not moral outrage. It is architecture. Once military SIGINT talent becomes venture-backed surveillance infrastructure, the legal wrapper changes but the strategic function often does not.

The hosting and jurisdiction layer matters here too. Kamatera, Private Layer, Seychelles shells, layered intermediaries, and cross-border legal wrappers all help convert military-grade capability into commercially deployable, litigiously evasive infrastructure. Once again, the properties required by spyware firms and by criminal operators rhyme closely: flexible infrastructure, legal distance, and enough ambiguity to delay consequences.

4. Case 3 — Vietnam / Viettel: the military telecom as proxy substrate

The Viettel case from Part M closes another gap. Here, the convergence does not primarily take the form of alumni-founded spyware vendors or explicit military operations. It takes the form of a state-owned military telecom whose residential broadband environment supplies the compromised routers powering a criminal proxy botnet. That does not prove state sponsorship of the botnet. It proves something more structural: the criminal market can parasitize institutional trust embedded in state infrastructure.

Viettel is owned by Vietnam’s Ministry of National Defence. Its residential subscribers inherit the legitimacy of ordinary civilian internet access through a military-owned telecom structure. Phantom Pipes then converts some of those subscriber endpoints into exit nodes. The result is a weird but important hybrid: the criminal operator borrows the credibility of civilian traffic from infrastructure whose ultimate institutional parent is military.

This is why the word convergence is more useful than the word conspiracy. Convergence does not require one command chain. It requires interoperable incentives and overlapping substrate. In the Viettel case, criminal proxy economics converge with state-owned network legitimacy. That is enough to produce impunity at the traffic layer.

5. Case 4 — Bangladesh / BTCL: transit visibility as sovereign advantage

State-criminal convergence also appears at the transit layer. Bangladesh Telecommunications Company Ltd (BTCL), as a state telecom positioned with broad traffic visibility, illustrates a different form of power: not necessarily hosting the attack logic, but possessing line-of-sight over it. When a state-controlled carrier functions as sole or dominant transit in a path, it occupies a privileged SIGINT position over whatever flows through that path, including attack traffic, criminal routing, and foreign infrastructure transiting the network.

This matters because infrastructure debates are often too endpoint-centric. We ask who owns the IP, who registered the domain, who rented the VPS. But transit confers a quieter power. A carrier with route visibility can observe, shape, prioritize, delay, mirror, or contextually analyze flows. Even if it does none of those aggressively, the position itself is strategic. And when that position belongs to a state actor, the notion that state infrastructure stands outside the abuse architecture becomes increasingly implausible.

The BTCL example extends the thesis: state benefit does not require direct authorship of attacks. It can arise from privileged observability over the same ecosystem that facilitates crime.

6. Case 5 — China / Tencent–Aceville: shell structures and state adjacency

The Tencent–Aceville pattern adds another jurisdictional form of convergence: the state-adjacent cloud shell. In this environment, registration jurisdiction, routing jurisdiction, geolocation, and operational reality do not align cleanly. That mismatch is often dismissed as ordinary global business complexity. Sometimes it is. But repeated cross-jurisdiction mismatches also perform a function: they maximize legal friction and obscure responsibility.

When cloud and network structures are wrapped through entities like Aceville, the boundary between commercial service, state adjacency, and surveillance-capable infrastructure becomes harder to draw. Again, the issue is not that every shell is espionage. The issue is that the same structural properties that make a cloud shell attractive for regulatory maneuver also make it attractive for both covert state activity and private abuse hosting.

At that point, the state/criminal distinction begins to depend less on infrastructure and more on narrative framing after discovery. The pipes do not confess their politics.

7. The M247 diagram: one transit spine, three user classes

Perhaps no single example captures the series thesis better than the repeated appearance of M247-linked infrastructure in contexts involving legitimate VPN users, state-intelligence cover, and outright criminal abuse. This is not because M247 is uniquely evil. It is because the company illustrates the economic neutrality of commodity internet infrastructure. The same route can serve a journalist, an intelligence officer, a credential stuffer, or a botnet controller. Infrastructure does not enforce moral separation. Business process rarely does either.

               [ Commodity Transit / Hosting Spine ]
                           M247 / VPN Layer
                   /             |                                 /              |                       Legitimate privacy     State cover       Criminal abuse
       users and travelers    and access ops    C2 / stuffing / proxying
                  \              |                /
                   \             |               /
                 Same AS paths, same resellers, same jurisdictional gaps

This is the real “mere conduit” problem taken to its final conclusion. Once a transit or VPN infrastructure serves heterogeneous users, the provider can always retreat to neutrality. But neutrality at the commercial layer becomes operational cover at the intelligence and criminal layers. That is why this architecture is so hard to reform without redesigning the economics of intermediation itself.

8. The five recurring jurisdictions: US, NL, DE, SG, SC

Across the series, five jurisdictions kept appearing as base layers for both state and criminal infrastructure: the United States, the Netherlands, Germany, Singapore, and the Seychelles. They recur not because they are morally equivalent, but because they offer a similar package of useful properties: connectivity, business infrastructure, established legal mechanisms that can be slow or fragmented in cross-border enforcement, and enough legitimacy to avoid instant suspicion.

The US offers scale, cloud dominance, legal complexity, and provider concentration. The Netherlands offers dense connectivity and historical centrality in European hosting. Germany offers strong infrastructure, industrial legitimacy, and a large service ecosystem. Singapore offers strategic Asian connectivity and a polished corporate environment. The Seychelles offers shell flexibility, offshore distance, and ownership opacity. Together they form a recurrent map of useful ambiguity.

Jurisdiction	Criminal utility	State utility	Observed series role
US	Cloud, scale, reputation laundering	Access to dominant platforms and legal cover inside allied systems	Recurring hosting and infrastructure anchor
NL	Dense transit and hosting	European operational reach	Transit and hosting common ground
DE	Legitimate industrial wrapper	Strong connectivity under rule-of-law branding	Operationally useful legitimacy
SG	Asian cloud and shell efficiency	Regional strategic routing and state-adjacent business cover	Tencent/Aceville-style friction minimization
SC	Offshore opacity and ownership distance	Deniable legal wrappers	Spyware and shell-company protection layer

These jurisdictions are not incidental scenery. They are the architectural stage on which both state and criminal actors can perform with minimal friction.

9. Why this cannot be fixed inside the current incentive model

At this point, calls for better abuse handling or more transparency sound inadequate because they are inadequate. The problem is not merely procedural. It is structural. States will not comprehensively reform infrastructure they use for intelligence. Providers will not voluntarily remove ambiguity that sustains high-margin customers and high-volume reseller models. Intermediaries will not collapse the shell layers that make them valuable. Even well-meaning reforms tend to be targeted at the most disposable actors, not the architectures that matter.

Consider the 96% abuse report failure rate discussed earlier in the series. On its face, that looks like negligence. But from the perspective of convergent state and criminal interests, it is a feature. Slow, weak, formally compliant abuse processing keeps infrastructure alive long enough to remain useful. A truly efficient abuse regime would not merely inconvenience scammers. It would also burn covert operational pathways and force intelligence services into narrower, costlier options.

This is also why debates over “cyber norms” often feel unserious compared to the underlying telemetry. Norms are spoken at diplomatic altitude. Infrastructure is purchased at wholesale volume. The latter wins.

10. The final architecture diagram: all fourteen parts in one picture

By the end of the series, the structure becomes visible as a stack. Each earlier part mapped a layer. The finale is simply the overlay.

Victim Layer
  ↓
Proxy Layer (Part M)
  Compromised residential routers, VPN exits, borrowed innocence
  ↓
Transit Layer (Parts E, K, L)
  Ordinary carriers, CDN paths, VPN backbones, M247-style shared spines
  ↓
Registry Layer (Parts A, G)
  RIR objects, registrars, contact laundering, reputation systems
  ↓
Incorporation Layer (Parts B, D-F and related shell work)
  Shell companies, offshore wrappers, nominees, resellers, legal friction
  ↓
Economic Layer (Part I)
  Margins, resale, monetizable delay, abuse as business model
  ↓
State Layer (Part N)
  Intelligence use, military telecoms, spyware pipelines, transit visibility
  ↓
Impunity Output
  Providers paid, states covered, criminals operating, victims dispersed

Seen this way, the series title stops being metaphorical. The Architecture of Impunity is literal. Impunity is built out of routers, contracts, ASNs, shells, exports, and polite abuse desks that do not work.

11. What the evidence actually supports — and what it does not

Precision matters here. The evidence supports the claim that state and criminal infrastructure repeatedly share the same providers, transit, jurisdictions, and commercial intermediaries. It supports the claim that some state capabilities are exported into private corporate form through talent pipelines, licensing, and investor structures. It supports the claim that state-owned or state-adjacent telecom environments can facilitate criminal abuse structurally, even without direct command responsibility. It supports the claim that reform incentives are weak because multiple powerful actor classes benefit from the status quo.

The evidence does not require the claim that every criminal service is state-controlled, that every permissive host is an intelligence cutout, or that every mixed-use network event proves explicit collusion. That level of certainty would exceed the record. The stronger argument is also the more defensible one: explicit coordination is not required when architecture already aligns interests.

12. Final statement

This is not a system that failed. It is a system that works exactly as designed for everyone who matters inside it. The criminals profit. The states gain cover. The providers get paid. The intermediaries earn margins on opacity. The abuse desks process just enough to appear legitimate. The registry layer remains weak enough to delay consequence. The transit layer remains neutral enough to deny meaning. The proxy layer remains human enough to borrow innocence. The victims remain numerous, distributed, and politically weak.

Victims do not write legislation. Victims do not negotiate wholesale transit. Victims do not structure offshore shells. Victims do not decide export licenses for spyware. Victims do not own the military telecom. Victims do not run the VPN backbone. Victims do not set the pace of MLAT response. They are the substrate from which losses are extracted.

And that is the final picture. The architecture persists because every powerful constituency touching it can explain its own role as incidental, neutral, or necessary. The criminal says it is just hosting. The provider says it is just transit. The telecom says it is just connectivity. The spyware firm says it is just lawful access. The state says it is just national security. Each statement is narrow enough to be defendable. Together they produce a world in which accountability never reaches the level where the system itself could change.

That is why this series ends here. Not because there is nothing left to investigate, but because the pattern is now complete. Once you see that governments and hackers share servers, the rest of the map stops being surprising. It becomes administrative detail.

13. The legal shield is not accidental; it is part of the service

One of the recurring mistakes in public cyber policy is to treat the legal shell around abusive infrastructure as a regrettable side effect. It is not a side effect. It is part of the product. Resellers, offshore entities, nominee structures, fragmented customer records, and contradictory jurisdictional anchors are not administrative clutter orbiting the infrastructure. They are integral to how the infrastructure retains value under pressure. The law is not merely failing to catch up. In many cases, the law’s friction points are already being sold as service features.

This is true for criminals in the obvious way. A phishing operator wants delay after takedown notice. A botnet operator wants confusion between reseller and upstream. A proxy vendor wants distance from the provenance of its nodes. But it is also true for states and state-adjacent firms. An intelligence service benefits when attribution must cross legal boundaries slowly. A spyware vendor benefits when the export-licensed tool is wrapped through private corporate form. A state-owned carrier benefits when structural visibility over traffic is treated as neutral background rather than geopolitical capability. The legal shield works for everyone above the victim layer.

This is why corporate answers so often sound interchangeable across wildly different actor classes. “We are only the host.” “We are only the registrar.” “We are only the carrier.” “We are only the platform.” “We are only the vendor.” Each sentence isolates one function from the operational totality. Each is individually arguable. Together they create a machine in which no layer admits authorship of the result.

14. What the victim experiences versus what the architecture knows

From the victim’s perspective, the architecture presents as randomness. A bank customer sees a compromised account. A target sees spyware on a phone. A company sees credential stuffing from what look like ordinary users. A researcher sees a phishing kit vanish and reappear on another VPS. A home subscriber never sees anything at all; their router simply becomes a silent employee of a proxy market. The system feels chaotic because each victim encounters only one surface.

From the architecture’s perspective, the events are not random. They are routinized. Credentials are bought and replayed. exits are verified and rotated. shells are incorporated where liability is cheapest. traffic is pushed through reputable backbones because reputable backbones are faster and less suspicious. surveillance capability is moved from unit to startup to customer under a legal wrapper that transforms coercive power into invoiceable service. Every piece that looks accidental from below looks administratively efficient from above.

This gap in perception is one reason reform pressure stays weak. The people absorbing the harm encounter it as fragments, while the actors benefiting from the system understand it as a coherent market.

15. Why “dual use” is too gentle a phrase

The standard policy phrase for infrastructure or tooling that can serve good and bad purposes is dual use. The phrase is not wrong, but in this context it is often too gentle to be analytically useful. Dual use suggests a stable thing that can be diverted. What we are actually observing is co-designed utility. VPN infrastructure is not accidentally useful for intelligence and criminals alike; its value emerges precisely because it can launder identity for multiple classes of user. Corporate shells are not accidentally useful for both exporters and fraud crews; opacity is the feature. Residential proxies are not accidentally useful to both ad-tech evaders and account-takeover operators; they sell human-looking origin as a commodity.

Once the shared value proposition is understood, the persistence of the architecture stops being mysterious. States and criminals are not bumping into each other awkwardly in the same building. They are frequenting the same building because the building was designed around properties they both require.

16. What serious reform would actually require

If one were serious about reducing this architecture rather than commenting on it, the reforms would be politically brutal. Strong beneficial-ownership transparency across resellers and shells. Real liability for repeated abuse facilitation at the hosting and transit layer. Consumer-router security baselines enforced through telecom and device ecosystems. Auditable provenance rules for commercial proxy networks. Export-control regimes that treat surveillance capability as infrastructure power rather than public-relations inconvenience. Mandatory operational logging and identity retention for certain classes of infrastructure brokerage. International pressure not merely on “bad actors” but on the mainstream jurisdictions and carriers that provide the trusted surface.

Those reforms are imaginable. They are also improbable precisely because they would inconvenience not just criminals, but major providers, allied intelligence interests, state-linked telecoms, and lucrative private surveillance firms. The obstacle is not conceptual difficulty. The obstacle is that the list of beneficiaries is longer than the list of reformers.

17. The final ethical asymmetry

There is an ethical asymmetry beneath all the technical detail. Every powerful actor in this system can describe its use of ambiguity as necessity. The VPN says privacy. The telecom says connectivity. The spyware company says lawful access. The intelligence service says national security. The host says neutrality. The registrar says process. The criminal says nothing, because silence is enough. Only the victim is denied a legitimating vocabulary. The victim is simply expected to absorb loss and prove it matters.

That asymmetry is why the architecture reproduces itself so effectively. The winners can always narrate their function upward into principle. The losers can only narrate harm downward into support tickets, police reports, account-recovery forms, and financial damage. A system organized this way does not drift toward justice on its own.

18. The intelligence advantage of criminal noise

One of the most under-discussed benefits that states derive from criminal infrastructure is cover by contamination. A noisy ecosystem of spam, credential abuse, residential proxies, throwaway VPS nodes, and permissive transit creates a background in which state activity can hide more effectively than it could inside a perfectly orderly network. Even when the state is not directly using the same exact node as a criminal, it benefits from the same surrounding disorder. Attribution slows down. Confidence language becomes cautious. Diplomatic consequences get delayed by analytic caveats. Noise is not merely a nuisance; it is a protective medium.

This helps explain why some parts of the system appear only partially governed. Total cleanup would not simply remove nuisance traffic. It would thin the atmospheric conditions that make deniable operations easier to mount. In a cleaner environment, anomalous access stands out faster. In a dirtier environment, everything has a plausible non-state explanation. The criminal ecosystem becomes an involuntary camouflage net for the state.

This is one reason the architecture feels irreducibly cynical. The presence of widespread cybercrime does not just harm citizens directly. It also improves the operating environment for actors powerful enough to exploit the ambiguity it creates.

19. The provider’s role: not mastermind, not innocent

It is tempting to reduce the entire system to evil providers, because providers are visible and billable. That simplification is emotionally satisfying and analytically incomplete. Most providers are not masterminds. Many are not even especially ideological. Their role is more banal and therefore more durable: they normalize the sale of capability while structuring responsibility to remain fragmentary. They are not the source of every mission. They are the commercial membrane through which many missions can pass.

This is why the strongest critique is not that every provider intends every abuse. The strongest critique is that the business architecture repeatedly rewards not knowing too much, not acting too fast, and not connecting events across customer categories. That cultivated incompleteness is what makes mixed-use infrastructure so profitable. The host can plausibly say it serves everybody because it really does. The problem is that “everybody” includes actor classes that the public is still encouraged to imagine as sharply separate.

That is why the provider layer belongs inside the architecture of impunity but should not be caricatured. Its power comes less from cartoon villainy than from repeatable business patterns that make accountability expensive.

20. After the line disappears

Once the line between state and criminal infrastructure disappears, some familiar public arguments become impossible to maintain honestly. One can no longer pretend that abuse persists only at the margins of the internet. One can no longer treat bulletproof hosting as a bizarre exception disconnected from mainstream connectivity. One can no longer assume that if a provider or jurisdiction is reputable enough, the infrastructure built there is politically innocent. And one can no longer believe that better user awareness alone can solve harms that are embedded in the economic and geopolitical design of the network itself.

The disappearance of the line does not mean all actors are morally equal. States, spy firms, telecoms, VPN providers, fraud crews, and botnet operators do different things for different ends. What disappears is the infrastructural distinction that would allow society to cleanly isolate one from the other. They overlap too much. They purchase from the same markets too often. They benefit from the same legal gaps too consistently. Their differences exist at the level of mission and mandate, not at the level of the pipes that carry their work.

That is the point at which threat intelligence stops being a catalog of actors and becomes a study of political economy. The interesting question is no longer “who abused this host?” It is “what kind of world keeps making this host useful?”